v1.0.0

What's Changed

• CodeQL Action v4, drop SHA-1, least-privilege test workflow; release 1.0.0 by @jabranr in #82

Full Changelog: v0.10.0...v1.0.0

v0.10.0

What's Changed

• docs(readme): highlight standalone binaries with latest-release download links by @jabranr in #78
• feat: add install.sh for the standalone binary (secure-ci.dev/install.sh) by @jabranr in #79
• docs(skills): add secureci agent skill by @jabranr in #81
• feat(init): pinned, code-scanning-ready workflow; release 0.10.0 by @jabranr in #80

Full Changelog: v0.9.0...v0.10.0

v0.9.0

What's Changed

• chore(deps): eslint 10, drop @jabraf/dev, fix minimatch advisory (release 0.9.0) by @jabranr in #77

Full Changelog: v0.8.0...v0.9.0

v0.8.0

What's Changed

• fix: harden container isolation, CI and supply chain (release 0.8.0) by @jabranr in #76

Full Changelog: v0.7.0...v0.8.0

v0.7.0

What's Changed

• fix: review follow-ups for 0.6.0 (JSON rule ids, warning log level, docs) by @jabranr in #72
• feat(validate): recognise actions/checkout's safe pull_request_target default by @jabranr in #74
• chore: release 0.7.0 by @jabranr in #75

Full Changelog: v0.6.0...v0.7.0

v0.6.0

What's Changed

• feat(validate): detect template injection in run: steps by @jabranr in #62
• feat(validate): flag missing or excessive GITHUB_TOKEN permissions by @jabranr in #63
• feat(validate): flag dangerous triggers with untrusted checkout by @jabranr in #64
• feat(run): add --env-file, --secret-file, --input-file and --var-file by @jabranr in #65
• feat: add secureci pin to rewrite action tags to commit SHAs by @jabranr in #66
• feat(inventory): flag actions with known security advisories by @jabranr in #67
• feat(run): add --matrix key:value to run a subset of combinations by @jabranr in #68
• feat: build standalone binaries with checksums and provenance by @jabranr in #69
• feat(run): run independent jobs and matrix combinations in parallel by @jabranr in #70

Full Changelog: v0.5.1...v0.6.0

v0.5.1

What's Changed

• fix(inventory): fail --check on unverifiable locked actions; show progress; release 0.5.1 by @jabranr in #61

Full Changelog: v0.5.0...v0.5.1

v0.5.0

What's Changed

• docs: point action examples at v0.4.0 by @jabranr in #59
• feat(inventory): lock transitive deps and repo identity; contract lockfile rule; release 0.5.0 by @jabranr in #60

Full Changelog: v0.4.0...v0.5.0

v0.4.0

What's Changed

• feat(validate): --contract from another repository; release 0.4.0 by @jabranr in #58

Full Changelog: v0.3.0...v0.4.0

v0.3.0

What's Changed

• feat(inventory): check GitHub's actions.lock when it's the only lockfile by @jabranr in #56
• chore(release): 0.3.0 by @jabranr in #57

Full Changelog: v0.2.0...v0.3.0